SecNumCloud

The foundational requirement of SecNumCloud is immunity from non-EU extraterritorial legislation, such as the U.S. CLOUD Act. Certified providers must demonstrate that their corporate structure, operational headquarters, and data processing activities are exclusively governed by EU and French law. This ensures that no foreign authority can legally compel the provider to grant access to hosted data.

• Corporate Ownership: The provider must be headquartered in an EU member state with no foreign controlling interests.
• Operational Sovereignty: All administrative and commercial operations managing the service must be located within the EU.
• Data Localization: All data at rest, in transit, and during processing must remain within EU borders.

SecNumCloud mandates the use of state-sanctioned cryptographic modules to protect data confidentiality. Encryption keys must be generated, stored, and managed within a sovereign boundary using hardware security modules (HSMs) that hold an ANSSI qualification. This prevents the cloud provider or any foreign entity from accessing plaintext data.

• Key Management: Requires Hold Your Own Key (HYOK) architectures where the client retains exclusive control.
• Algorithmic Compliance: Mandates the use of ANSSI-approved ciphers and key lengths, often exceeding generic industry standards.
• Physical Security: HSMs must be hosted in certified data centers within France, under the exclusive control of EU citizens.

Certified providers must implement a Security Information and Event Management (SIEM) system that continuously monitors the entire infrastructure for threats. They are contractually obligated to notify ANSSI and affected clients of any security incident within a defined, legally binding timeframe. This ensures a proactive, state-integrated defense posture.

• Active Monitoring: 24/7 surveillance of networks, systems, and applications for anomalous behavior.
• Mandatory Reporting: Legally enforced timelines for reporting data breaches to the national authority.
• Penetration Testing: Regular, independent security audits and intrusion tests are required to maintain certification.

The latest version of the framework introduces differentiated protection levels to address varying data sensitivity. The standard level covers sensitive commercial data, while the 'Advanced' level adds hardware-based confidential computing and memory encryption to protect against privileged insider threats and host-level vulnerabilities.

• Standard Level: Logical isolation, ANSSI-qualified encryption, and EU jurisdictional control.
• Advanced Level: Adds Trusted Execution Environments (TEEs) to encrypt data in use, isolating it from the cloud provider's own administrators.
• Migration Path: Provides a clear technical roadmap for organizations to escalate their security posture as threats evolve.

SecNumCloud extends its security requirements to the human element and the software supply chain. All personnel with administrative access to the infrastructure must undergo ANSSI-approved security clearance. Furthermore, providers must maintain a verified Software Bill of Materials (SBOM) to guarantee the provenance and integrity of every software component used in the service.

• Personnel Vetting: EU-citizen-only staffing with mandatory security clearances for privileged roles.
• Supply Chain Transparency: Full traceability of all third-party libraries and dependencies to prevent supply chain attacks.
• Operational Integrity: Strict segregation of duties to ensure no single individual can compromise data sovereignty.

A cloud architecture ensuring all data and metadata remains under the exclusive jurisdictional control of a specific nation. Unlike standard public cloud, a sovereign cloud eliminates foreign administrative access by requiring local legal entities to operate the infrastructure. SecNumCloud is the French implementation of this principle, combining technical controls with a legal wrapper that prevents extraterritorial data requests under laws like the U.S. CLOUD Act.

These two concepts are often conflated but serve distinct purposes:

• Data Residency: The physical storage location of data, often a business choice for latency or policy reasons.
• Data Localization: A legal mandate requiring data to remain within national borders, prohibiting cross-border transfer. SecNumCloud enforces localization by requiring all processing and storage to occur within French territory, satisfying the most stringent government requirements.

A European initiative building a federated, interoperable data infrastructure based on open standards. Gaia-X defines a common rulebook for identity, trust, and data sovereignty across member states. While SecNumCloud is a national certification, Gaia-X provides the cross-border federation layer that allows certified French clouds to interoperate with other European sovereign infrastructures without compromising jurisdictional control.

Two legal frameworks that fundamentally shaped the demand for SecNumCloud:

• Schrems II (2020): Invalidated the EU-US Privacy Shield, ruling that U.S. surveillance laws do not provide adequate protection for EU data.
• CLOUD Act (2018): Compels U.S.-based cloud providers to hand over data to law enforcement regardless of where it is stored. SecNumCloud directly mitigates these risks by ensuring no foreign administrative access to data.

A cryptographic model where the data owner retains exclusive control over master encryption keys. The cloud provider cannot decrypt data without explicit authorization. In a SecNumCloud environment, HYOK is often combined with hardware security modules (HSMs) located within French territory, ensuring that even the infrastructure operator cannot access plaintext data under foreign legal compulsion.

A pre-configured, compliant cloud environment template that enforces data residency, access controls, and encryption policies from the moment a workload is deployed. A SecNumCloud-aligned landing zone automatically applies:

• Geofencing to restrict data movement
• Encryption with locally managed keys
• Identity policies tied to national directories This accelerates compliance for government agencies migrating sensitive workloads.